acaf3c2435f713d824eb91ec0fe200446b2cc70967c444fe4ded4b74d420e00d

Analysis

max time kernel
138s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 04:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-07_c2dab5f7f369295e3359e8ac55e9b5f3_cryptolocker.exe
Size

68KB
MD5

c2dab5f7f369295e3359e8ac55e9b5f3
SHA1

ff47efdb538c1bbfc76a8493f16037bdc2350d7f
SHA256

acaf3c2435f713d824eb91ec0fe200446b2cc70967c444fe4ded4b74d420e00d
SHA512

00d342bbd9b5ddcfb67b3e1981cc6ace1f2a4169bb1bf7f53f4363a5896822f2311ab787defb8ddc969bd5ed357de1b39c8d2be970942a130025783038574ae2
SSDEEP

1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKUs:DW60sllyWOtEvwDpjwF85e

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/2376-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x0009000000012272-11.dat	CryptoLocker_rule2
behavioral1/memory/2376-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2624-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/2376-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x0009000000012272-11.dat	CryptoLocker_set1
behavioral1/memory/2376-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2624-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2624	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2376	2024-03-07_c2dab5f7f369295e3359e8ac55e9b5f3_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2624	2376	2024-03-07_c2dab5f7f369295e3359e8ac55e9b5f3_cryptolocker.exe	28
PID 2376 wrote to memory of 2624	2376	2024-03-07_c2dab5f7f369295e3359e8ac55e9b5f3_cryptolocker.exe	28
PID 2376 wrote to memory of 2624	2376	2024-03-07_c2dab5f7f369295e3359e8ac55e9b5f3_cryptolocker.exe	28
PID 2376 wrote to memory of 2624	2376	2024-03-07_c2dab5f7f369295e3359e8ac55e9b5f3_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-07_c2dab5f7f369295e3359e8ac55e9b5f3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-07_c2dab5f7f369295e3359e8ac55e9b5f3_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
68KB

MD5
cfb51b47a138520315767abef97d8a63

SHA1
f199873629dec7b2c5232d8117fbcc9f87005b2c

SHA256
8708585c194ba784280352f4f80e0dc24661b2d372c1f804c2dd9438ab5d158c

SHA512
4d25ed44081a883c7e13e0a7e668083fc5a0efd5fc9294c631bdd79c87b0408b60b07f32187954559466217a9f6914cf4b2c15df5d91e02d6c89c37fd81e1cf7

Download Submit
memory/2376-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2376-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2376-3-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2376-2-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2376-15-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2624-16-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2624-19-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2624-18-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download